Topic starter
24/10/2026 8:54 pm
TL;DR: Multi-channel social engineering is moving beyond email, because attackers now use Slack, Teams, social media and live meetings to exploit trust, according to Doppel's 2026 social engineering predictions. Detection and response have to follow the full interaction path instead of relying on mailbox review alone.
Editorial analysis by NHI Mgmt Group, based on content published by Doppel: “2026 Social Engineering Defense Predictions”.
Key questions
Q: Why do AI-generated impersonation attacks make manual investigation less effective?
A: AI reduces the cost of creating believable, varied lures at scale, so analysts face more incidents that look plausible and arrive faster than they can review them.
A: Teams should treat launch as a campaign correlation problem, not a single-message problem.
Q: What breaks when phishing moves beyond email into collaboration apps?
A: Email-only defence breaks because the attacker no longer needs to win inside the mailbox.
Practitioner guidance
- Expand monitoring beyond email Instrument Slack, Teams, social channels and meeting workflows so suspicious impersonation is visible where it starts, not only where it lands.
- Build verification steps into high-risk requests Require out-of-band identity checks for payment changes, credential resets, executive instructions and other high-impact requests that attackers commonly impersonate.
- Automate correlation across brand and identity signals Connect collaboration alerts, impersonation reports and fraud indicators so analysts see a campaign rather than isolated messages.
Bottom line: Social engineering is evolving into a multi-channel trust attack that crosses collaboration tools, social platforms and live meetings, so email-centric controls no longer cover the full threat.
Glossary terms: Multi-Channel Social Engineering, AI-Native Deception, Agentic Defense Loop, Activation Trust Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
25/10/2026 11:13 am
Multi-channel social engineering is now an identity governance problem, not just a messaging problem. Once attacks move across Slack, Teams, social media and meetings, the security question becomes whether the organisation can verify who is asking, in which context and with what authority. That is the same trust problem that underpins collaboration tool security and broader identity verification. Teams that still treat phishing as an email issue are defending the wrong layer.
A few things that frame the scale:
- 28% of secrets incidents now originate outside code repositories, in Slack, Jira, and Confluence, and are 13% more likely to be categorised as critical than code-based leaks, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between phishing detection and social engineering defense?
A: Phishing detection focuses on identifying malicious messages, usually in email, while social engineering defense covers the broader trust attack that can start in chat, social media, voice or live meetings. The latter requires identity verification, workflow controls and rapid response across channels. If the defence only inspects messages, it misses the persuasion stage.
👉 Read our full editorial: Multi-channel social engineering now outpaces manual defence
This post was modified 6 days ago by NHI Mgmt Group